Are there formal security definitions or frameworks to evaluate the quality of a key management scheme? Can I state something like "the key is XYZ-protected against a polynomial adversary given that [constraint] holds"? Or "that solution has a key exposure factor of 0.72"?
For example, I can intuitively see that a key that is secret shared has better protection than a key that is not (because, for a threshold t, t shares would need to be compromised to calculate the key). Or that a key inside an HSM is harder to retrieve than a key in a plaintext file in a PC. But how harder?
How can I objectively argue that a control is critical to protect the key (or the opposite: that discarding a specific control is acceptable in a scenario)?
I realize that a definitive answer will depend on the threat model and the risks that could be accepted, but I wonder if there are terms and parameters that can be used to compare alternatives.